The protection of personally identifiable information (PII) is of concern as more and more information is stored and shared electronically. There are a number of laws that govern how PII can be used and how it must be protected. For example, some Canadian provinces have enacted laws to address how private electronic information, such as PII, collected by public Canadian institutions can be handled. These laws require that private data not cross provincial or Canadian borders, or be accessed by citizens or authorities of other countries. These types of laws may limit the ability of provincial residents to use applications or services that are hosted outside of the province if the application requests PII. It is not uncommon for the server that hosts an application or service to be located in a different jurisdiction from the user of the application or service. For example, a provider of a learning management system (LMS) may host the software for the LMS on a server in one jurisdiction, but serve students in a number of other jurisdictions. However, the LMS may not be able to serve students of an institution located in a jurisdiction that prohibits the transmission of the student's PII outside the jurisdiction when the LMS is located outside the jurisdiction.
To accommodate laws that prohibit the transmission of PII outside the jurisdiction or otherwise require special handling of PII, a provider can choose to host its application or service within that jurisdiction or to provide specific applications or services to address the special handling required by that jurisdiction. However, these approaches increase cost and complexity for the provider. Alternatively, a user or institution can choose to limit themselves to only those applications and services that are hosted within their jurisdiction or that provide the special handling of PII, but in doing so may deprive themselves of access to the best available resources.
Since users want access to the best available applications and solutions regardless of where they may be hosted, there is a need for a solution that protects PII without requiring separate hosting or special handling for different jurisdictions.